Here's a few best practice links that may help. They need to be consolidated in the documentation.
Audit Policies and Best Practices for LEM
LEM Best Practices for Memory Allocation
LEM Agent Benefits and Best Practices
Best Practices for Log and Event Manager (video)
Steve